[Paper Review] Why developers cannot embed privacy into software systems? An empirical investigation

Awanthika Senarath, Nalin Asanka Gamagedara Arachchilage|arXiv (Cornell University)|May 24, 2018

Privacy, Security, and Data Protection30 references16 citations

TL;DR

This empirical study investigates why software developers struggle to implement privacy-preserving systems despite established practices like Privacy by Design (PbD). Through a controlled design task with 36 developers, the authors identify key challenges—such as lack of privacy-specific knowledge, unclear requirements, and insufficient tooling—and propose actionable guidelines to bridge the gap between privacy principles and practical implementation in software development.

ABSTRACT

Pervasive use of software applications continues to challenge user privacy when users interact with software systems. Even though privacy practices such as Privacy by Design (PbD), have clear in- structions for software developers to embed privacy into software designs, those practices are yet to become a common practice among software developers. The difficulty of developing privacy preserv- ing software systems highlights the importance of investigating software developers and the problems they face when they are asked to embed privacy into application designs. Software devel- opers are the community who can put practices such as PbD into action. Therefore, identifying problems they face when embed- ding privacy into software applications and providing solutions to those problems are important to enable the development of privacy preserving software systems. This study investigates 36 software developers in a software design task with instructions to embed privacy in order to identify the problems they face. We derive rec- ommendation guidelines to address the problems to enable the development of privacy preserving software systems.

Motivation & Objective

• To understand the barriers software developers face when embedding privacy into software systems.
• To investigate the practical challenges developers encounter when applying Privacy by Design (PbD) principles.
• To identify gaps in knowledge, tools, and requirements that hinder privacy-by-design implementation.
• To derive practical, evidence-based guidelines to support developers in building privacy-preserving software systems.

Proposed method

• Conducted an empirical study with 36 professional software developers in a controlled design task.
• Provided participants with a software design scenario and explicit instructions to embed privacy using PbD principles.
• Collected qualitative data through interviews and observations to analyze developers' thought processes and challenges.
• Thematic analysis was applied to identify recurring problems and root causes in privacy implementation.
• Developed a set of actionable guidelines based on observed challenges and developer feedback.
• Validated the relevance and practicality of the guidelines through iterative analysis of developer responses.

Experimental results

Research questions

• RQ1 What specific challenges do software developers encounter when asked to embed privacy into software designs?
• RQ2 How do gaps in privacy knowledge, unclear requirements, and lack of tooling affect developers’ ability to implement privacy-by-design?
• RQ3 What are the primary barriers preventing developers from consistently applying Privacy by Design (PbD) principles?
• RQ4 How do developers interpret and act upon privacy requirements in the absence of clear specifications?
• RQ5 What practical recommendations can be derived to support developers in building privacy-preserving software systems?

Key findings

• A significant number of developers lacked foundational knowledge of privacy-specific concepts, such as data minimization and purpose limitation.
• Many developers struggled to interpret privacy requirements due to ambiguity and lack of specificity in design briefs.
• The absence of privacy-aware development tools and frameworks was a major impediment to effective implementation.
• Even when developers understood privacy principles, they often failed to apply them consistently due to time and resource constraints.
• Developers frequently prioritized functional correctness and performance over privacy, especially under tight deadlines.
• The study revealed a clear mismatch between theoretical privacy frameworks and the practical realities of software development workflows.